Privacy Policy

1. Data we process

• Account data: email address, display name, password hash or Google account identifier, optional profile photo, bio and interests.
• Travel preferences: your home city, travel dates, pricing preferences and saved meetup plans.
• Social data: friend connections, friend invitations you send, and messages you post in trip chats.
• Technical data: IP address, device and browser information, and security logs generated when you sign in.
• Email delivery data: delivery status of transactional emails we send you.

2. Purposes and legal bases

• Providing the Service — creating your account, searching flights, ranking meeting cities, managing friends and trips: performance of a contract (Art. 6(1)(b) GDPR).
• Transactional emails such as sign-in links, friend invitations and trip notifications: performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention, and keeping the Service reliable: legitimate interests (Art. 6(1)(f) GDPR).
• Optional features you explicitly enable, such as live fare lookups: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Complying with legal obligations: Art. 6(1)(c) GDPR.

3. Recipients and processors

We share data only with service providers acting as processors under Art. 28 GDPR: our hosting and database provider, our transactional email provider, and flight-pricing providers used to retrieve fares for the routes you search. We do not sell your personal data and we do not use it for third-party advertising.

4. International transfers

Some processors may process data outside the European Economic Area. Where that happens, transfers are safeguarded by the European Commission's Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account, trip and message data for as long as your account exists. When you delete your account, we delete or anonymise your personal data, except where longer retention is required by law or needed to resolve disputes. Cached fare data and security logs are kept for a short period and then deleted.

6. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at privacy@halvway.app.

7. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in and to remember where you were headed before signing in. We do not use advertising or cross-site tracking cookies.

8. Children

The Service is not directed at children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Changes and contact

We may update this Policy; material changes will be announced in the Service. Contact: Colab Solutions LLC, privacy@halvway.app.